I don't wait for attackers to find the holes. I find them first.
Based in Singapore, I'm a senior penetration tester who has spent the last 4 years breaking into things legally. My experience spans across government agencies, global MNCs and SMEs across Singapore. Whether it's a misconfigured JWT, or an exposed Admin Panel prone to CVEs, I've tried a few stuff during the years and really enjoy discovering new vulnerabilities.
Notably, I discovered a CRITICAL 9.8 CVE granting full administrative access on a Windows Endpoint. Hopefully, there will be more CVEs to come below!
Unauthenticated arbitrary file upload in the Media Manager function allows attackers to upload a crafted PHP file and execute arbitrary code — yielding full administrative access on Windows.
A candid breakdown of the OSCP journey — the pain, the methodology, the 24-hour exam war stories, and what it actually takes to earn one of offensive security's most respected certs. Pinned article on Medium.
Read on Medium →How a single unvalidated upload endpoint in CLESS Server v4.5.2 led to unauthenticated remote code execution and full Windows admin takeover. CVSS 9.8 CRITICAL.
Read PoC →Custom web security testing suite — automated recon, parameter fuzzing, endpoint enumeration, and vulnerability discovery streamlined for Web VAPT engagements.
GitHub →Converts Nessus CIS compliance scan results into structured, client-ready Excel reports with full summary of comply/non-comply findings. Eliminates hours of post-scan manual formatting.
GitHub →Terminal-driven tool that automates VA reporting — removes risk-accepted findings, buckets by category, reassesses CVSS scores, and closes remediated findings in your tracking spreadsheet.
GitHub →Automation scripts for exploit development workflows built during OSED prep. Handles bad character analysis, shellcode generation, and skeleton exploit scaffolding.
GitHub →I would love to connect, if you just wanna talk about CyberSecurity or Pentesting in general. Feel free to reach out to me via any of my contact details below :)
For sensitive communications, please encrypt with my PGP key. Fastest responses via email or LinkedIn.